[espi]

Weekly update-knowledge pass, window Oct 12 – Oct 19 2026. Five research agents; every load-bearing claim below was re-fetched and verified by the lead against a primary, not relayed from an agent's report.

⚠️ This PR is stacked on #28, which is stacked on #27, which is stacked on #26. Its base is #28's branch, not main. Per the skill's step 1 I branched from #28's head (2f81cca) because main is 2,000+ lines stale. Review or merge #26, then #27, then #28 first; GitHub will retarget this automatically as they land. The diff shown here is my one commit only.

Routine self-improvements

Applied (auto-gated): none this pass.

I ran the step 7 scan and found no auto-apply candidate. Specifically, I verified on disk that all thirteen step-number cross-references in SKILL.md point at the right steps, that every path it references resolves (kb-size.yml, self-edit-guard.yml, all four knowledge/ files, guardrails/budget.env, runbooks/staying-current.md, CLAUDE.md), that the one relative link ../../../knowledge/archive/resolved-caveats.md resolves from the skill's own directory, and that no line has unbalanced backticks. Nothing stale, no broken link, no typo — so default-deny applies and SKILL.md is untouched. git diff --name-only confirms knowledge/ only, and there is no self-edit: commit for self-edit-guard to inspect.

Suggested (needs your confirm):

1. 🔴 Your repo's main has no branch protection, and that makes two of this repo's own declared gates not gates. This is the one item I'd act on first, because it is now measured rather than inferred: the GitHub API reports espi/loops's main as "protected": false. Read against the current routines doc — "Claude pushes its work to a branch prefixed with claude/ unless your prompt directs it to push to another branch. To control which branches a run can push to, use branch protection rules or rulesets on GitHub" — the claims in runbooks/staying-current.md ("it physically cannot touch main") and SKILL.md step 8 ("the routine physically can't touch main") are false. ✅ And self-edit-guard.yml's own header already says the same thing about itself: "To make this a hard merge gate (not just a visible red X the reviewer sees), add it as a required status check in the repo's branch-protection rules for main. Without that, human merge remains the enforcement floor." ➜ One action fixes both: a ruleset on main that the connected identity cannot bypass, with self-edit-guard as a required check. Confidence upgraded Medium → High (the doc is now affirmative, not merely silent). ⚠️ Honest residual: the branches API reflects classic protection, and a ruleset is a separate mechanism I could not read with the available tooling. → Routed to you: runbooks/** and step 8's branch rule are both always-suggest.
2. 🔴 The verification non-negotiable should require a check that fails closed. CLAUDE.md mandates a deterministic pass/fail check inside the loop but says nothing about its behaviour on absence. The pass found a name and a taxonomy for exactly that gap (vacuity, "satisfied by the absence of the thing checked") plus six shipping instances. Proposed wording to add alongside last pass's provenance clause: exhaustion, timeout and error must not be expressible as pass. → CLAUDE.md and the three hard stops are always-suggest.
3. 🔴 The primer's §6 argument that "the budget ceiling would have caught it" was wrong, and guardrails/ may still rest on the unqualified version. I corrected the primer, but hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3's enforcement has now failed open twice (v2.1.217 and v2.1.299) and guardrails//templates/ were not reviewed against that. → guardrails/ is always-suggest.
4. Add "test every ceiling at zero" to guardrails/checklist.md, and make the harness record which stop fired. The first generalises three independent instances found this pass; the second comes from arXiv:2610.21098 ("most failures end at a harness limit", and the failure record doesn't say which). → guardrails/.
5. Set CLAUDE_CODE_RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS in guardrails/budget.env and the templates, beside the existing watchdog settings. Both watchdog bounds are opt-in, so the default is still an unbounded wall-clock wait. → guardrails/.
6. Decide whether the non-negotiables should name a fourth stop, or fold wall-clock into knowledge: second update pass (2026-06-09) #1. templates/ralph/run.sh already applies a per-call timeout, so the practice is ahead of the doctrine; Gemini exposes a per-agent maxTimeMinutes. → Changes the three hard stops, so always-suggest.
7. artifact-audit has no trigger for "the model or harness changed, so re-measure the skills library" — carried forward from last pass and reinforced by 2610.08875 v2's 17 authoring practices, which are directly usable for this repo's own .claude/skills/. → Another skill, so always-suggest.
8. 🔴 A scope decision on the backlog itself, which I think matters more than any single finding below. Last pass flagged it as "growing faster than it resolves" at 56 → 95. It is now 95 → 127 and the ratio got worse. A large share of the growth is corrections to this KB's own prior claims rather than news about the world — seven this pass alone. Plausible structural fixes: cap the backlog; split "live tripwires" from "standing cautions that will never resolve" (Cherny's absent feed, the x.com gap, Steinberger's coverage limit); or let the oldest items age out with a recorded decision rather than accumulating. → A human call about scope, not research.
9. Note on method, not a change request. The single highest-yield thing I did this pass was grep the whole changelog rather than the in-window slice — that is how v2.1.217's --max-budget-usd failure surfaced after sitting available for three months. The standing "backfill sweep" suggestion is now evidence-backed, and I'd extend it to "grep the full history per hard-stop token every pass", which is cheap.

---

The headline: hard stop #3 is not the backstop the doctrine assumed

§6 has argued that hard stop #1's repeated failures were survivable because "what would have caught them is the budget ceiling or the stall detector." That argument no longer holds.

• v2.1.299 (Oct 14): "Fixed a mod that submits a prompt at the end of every turn keeping a headless run going past --max-turns, --max-budget-usd, an interrupt, or the end of the host's conversation." One bug, two hard stops. Every prior leak was first-party; this is third-party installed code overriding the harness's own budget ceiling.
• ⚠️ And it is documented capability, not a stray defect. The mods doc: a mod "runs with your permissions", can "submit a prompt as if you had typed it", and "Mods aren't sandboxed." So an install-time trust decision can defeat the harness's ceilings.
• 🔴 And hard stop knowledge: 2026-06-22 update pass (7-day delta from Jun 15) #3 had already failed open once, which this KB never knew. A grep of the whole changelog returns only five --max-budget-usd mentions ever, and v2.1.217 (21 July 2026) is one: "Fixed --max-budget-usd not stopping background subagents." That sat available for three months, invisible to a weekly window-scoped sweep — the strongest possible vindication of the standing "the window sweep misses older work" item.

And "interrupt/resume is where stops leak" graduated from a Claude Code bug to a cross-vendor property. v2.1.299 is the third CLAUDE_CODE_RESUME_INTERRUPTED_TURN turn-accounting defeat in 15 days (eight fixes to that setting across its life). One day later Codex 0.163.0 (Oct 15) fixed a structurally identical leak of hard stop #2 — before it, every interrupt reset the consecutive-empty-turn counter, so the no-activity breaker (hardcoded >= 3) could be deferred indefinitely by interrupting. I verified it from source at the tag: let empty = automatic && !turn.has_activity && (turn.empty_final || interrupted); Two vendors, two languages, two different hard stops, same week, same seam.

🔴 The failure this repo kept rediscovering has a name, a taxonomy and an instrument

The highest-value result came from the backfill read, not the window. arXiv:2609.27871 ("Bounded Loops", v1 2026-08-20, cs.SE) defines a bounded loop as "a worker, an independent gate the worker cannot write to, and a declared budget" — this repo's doctrine in three terms — with the budget "enforced inside an attempt, not between attempts." And it names the two ways "a sound-looking check [can] pass anything": vacuity ("satisfied by the absence of the thing checked") and self-attestation ("where the subject supplies the value the check is applied to"), finding 47 vacuous gates in 69 shipped, reviewed loops. ⚠️ Cite its apparatus, not its numbers — the authors say so themselves: a fresh mutant family "recovers a 23.3% false-accept rate where the exhausted corpus reported none", and "the apparatus, not our number, is the contribution."

Six independent instances, which is why the name earns its keep: Anthropic Code Review's cap ("skips the review", check "doesn't conclude as a failure" — a correctly-configured hard ceiling can produce an unreviewed merge); roborev's success meaning "a comment was posted, including comments that contain findings"; CodeRabbit's "Incomplete analysis alone does not cause failure"; Qodo 3.1 (Oct 15) shipping "automatic rule deactivation for rules whose findings are rarely fixed" — a gate that erodes its own surface through use; 2610.23362 in deployed safety monitors ("the evidence is already recognized yet disconnected from enforcement"); and 2610.19264, where 59% of declaring skill listings understate what their bundle can do.

✅ The safe design is attested twice — Ellipsis ("never as an approval"; "when no reviewer finishes, nothing is posted and nothing is marked reviewed") and Greyling (a verifier "makes rejection the default, so the agent's output must 'earn' approval").

Corrections this pass owes the knowledge base

Claim in the KB	What's true
"No tool both caps spend and gates merges"	False. CodeRabbit gates merges (pre-merge checks in error mode + a fail-closed Security required check) and reportedly caps spend. And roborev does neither — "The cap never stops jobs" — where the KB credited it with the spend-cap half. Surviving, sharper claim: no reviewer documents what its spend cap does to its merge gate.
Ellipsis "never counts as an approval"	Not on the page. Actual: "never as an approval" / "A review in which a reviewer stopped early never approves", plus the stronger "when no reviewer finishes, nothing is posted and nothing is marked reviewed."
Anthropic Code Review's two quoted sentences	Both gone from the page. Replace with "A review never approves or blocks the pull request" and "The check run doesn't conclude as a failure."
Gemini maxSessionTurns = "history retention, docs ambiguous"	It is a real stop-at-limit iteration cap — three enforcement sites, zero history-trimming sites in the shipped bundle. The docs are wrong in two of three places and in the settings dialog.
"Haiku 4.5 is the /goal evaluator on every non-Anthropic provider; check next pass"	The tripwire could never be answered from that page, which says its dates "apply to Anthropic-operated platforms… Partner-operated platforms (Amazon Bedrock and Google Cloud) set their own retirement schedules." Haiku 4.5 is still Active, not even deprecated, four days past its floor — a "not sooner than" date is a floor, not a schedule.
Qodo 3.0	Qodo 3.1, 15 Oct 2026.
gascity	Use gastownhall/gascity — steveyegge/gascity is not publicly readable.

✅ Google Cloud Spend Caps went GA (Oct 13) — and GA did not fix the leak

Verified from the release-notes page's own dated entry: "October 13, 2026 — Spend cap budgets are now generally available for a limited set of services." The first GA'd project-level spend ceiling from a hyperscaler (AWS's is still limited-availability). ⚠️ Every caveat is live verbatim at GA: "spend cap enforcement isn't instantaneous", "Any in-flight requests … are processed to completion, accruing charges as applicable", "You remain responsible for any overage costs accrued due to reporting latency", plus up to an hour to resume. Still one project × one eligible service, monthly, enforced on estimated costs. ✅ Google states this repo's runway rule itself: "Consider setting your budget slightly below your absolute limit." The strongest first-party statement yet of invariant (a): a ceiling bounds new work, not the bill.

🔴 Most transferable finding: a guard gated on the truthiness of its own limit is not a guard

Three instances, each read from source. LiteLLM reads max_budget = 0 as unlimited in all three router paths and v1.106.0 (Oct 18) still ships it — ⚠️ and the sharper fact is that the surrounding budget-window code was refactored in-window while the zero guard was left alone, so this is neglect of the bug, not of the file (#44259 still open, no activity since Oct 2). ralph-tui gates its cap on maxIterations > 0, so the documented-as-valid 0 silently removes hard stop #1. Gemini CLI means both things with one value in one binary: maxSessionTurns: 0 stops on turn 1 in two code paths (>= 0) and is no cap at all in a third (> 0) — the cleanest instance the KB has, because there is no doc ambiguity to hide behind. ✅ The correct form is attested in code: agentgateway (AAIF-hosted) uses an unconditional used >= budget.limit.amount with an Audit/Block enum, and Gas City's withDefaults "fills every unset or non-positive duration and threshold… so no Policy can pace at zero."

The meter is wrong four ways now, across two vendors — two of them stop a loop early

Claude Code: under-counting (v2.1.286), over-pricing 2× (v2.1.296), and ⚠️ a cloud session's cost and usage "restarting from zero after the session resumed in a new process" (v2.1.302 — the spend analogue of /goal's baseline reset, changelog-only, and cloud sessions are what Routines run on). Agent Router: a systematic +1 token per request against a token quota, "resulting in 29 tokens deducted" for a 28-token request — unreleased. Relatedly, Anthropic's Spend Limits API disowns itself as a control: period_to_date_spend "may read as "0" if the spend reading is temporarily unavailable; treat it as informational, not transactional" — a fifth meaning of zero, and here it means unknown, so a harness comparing it to a ceiling proceeds during an outage.

This routine's own substrate

• ⚠️ A partway-failed routine run was silently re-run from the start (v2.1.302), "which could repeat work such as posting the same report twice" — for this routine that means a second PR, which is exactly what step 1's "extend the open PR" guard protects against. The runbook should say the routine's side effects must be idempotent regardless of the fix.
• ⚠️ Routine runs were reporting Completed for runs that died — a fourth way a routine appears to have run while doing nothing.
• ⚠️ npm dist-tags.stable is 2.1.292 while latest is 2.1.303 — a harness pinned to stable is eleven versions behind and has none of the fixes above.

Other findings worth your time

• The academic literature on this repo's exact subject exists and the KB had never cited it. arXiv:2608.21884 (Treude, Baltes et al.) mined 36,710 repositories, confirming loops in 217 of 256 matched, and its headline is a rebuke to prescriptive loop advice: "The repositories commit the configuration around these loops, but almost none commits the state files the discourse prescribes." It dates Osmani's coinage (25 July 2026, revising Yegge's January 2026 stages) and concludes verification cost is the bound on delegation. arXiv:2607.00038 defines a "loop specification" — trigger, goal, verification step, stopping rule, memory. ⭐ Two independent groups, different methods, agree: verification is the most mature part of the practice and durable state the least.
• ⚠️ The sharpest number yet on whether an agent-written suite can be the gate: arXiv:2610.18004 (SWEPatchTest, n = 619 tasks / 82,579 patches) — "the best-performing configuration achieves only 9.21%… despite reproducing the reference transition on 59.29% of tasks." Reproduction alone, the usual bar, is nearly uninformative.
• ⚠️ Osmani's "Agentic Verification" (Oct 14) names a failure mode that defeats naive stall detection: "The agent… learns from the incentives of the loop", and "Both failure modes cause the agent to get worse, but without any visible sign of failure" — the loop looks busy while degrading.
• ⭐ A first-party account of the doctrine enforced at scale (Anthropic, Oct 15): "ask it to show the output instead of saying it's done"; a real merge gate ("A PR can't merge while any finding… is still open"); findings filtered by an agent vote; "Any incidents are now an eval"; a REVIEW.md beside CLAUDE.md. ⚠️ Mind the gap between practice and product: Anthropic's own PRs are blocked by open findings while its shipped Code Review "never blocks merging." And a first-party non-convergent loop: "One CLI PR went through more than fifty rounds of review and fixes overnight before its author stopped it", 59% of repeat flags on code already there at the first pass.
• ⚠️ A low ASR is not evidence of a working defence — arXiv:2610.23254 (n = 33,000 trajectories): "most failed attacks are ignored (76-80%) rather than refused", and "changing only the system prompt shifts InjecAgent ASR from 0.2% to 43%" on identical weights.
• Peers, precisely: ✅ a hard dollar ceiling remains unique to Anthropic. ⚠️ Goose v1.55.0 rewrote its loop into a state machine; GOOSE_MAX_TURNS (default 1000) still "stops and prompts" — in an unattended loop with nobody to answer, that is a hang, not a stop. ⚠️ Codex's ext/goal (on by default, stable) splits exactly as this doctrine predicts: token budget harness-enforced ("Budget limits take precedence over pausing"), no-progress and completion left to prompt instructions the model grades. Cursor's /goal is still "Rolling out" after ~9 weeks; Factory shipped 7 releases with zero hard-stop changes; Aider has had one release in fourteen months.
• ✅ AAIF membership settled on a Linux Foundation primary — founding contributions are "Anthropic's Model Context Protocol (MCP), Block's goose, and OpenAI's AGENTS.md"; Agent Skills appears nowhere, and aaif.io/projects confirms while naming Agent Router as hosted. Agent Skills still has no tag, release, version, charter or TSC and has been quiet since 2026-08-09.
• Clean negatives worth having: zero in-window hits for the subagent caps (20 / depth 3), both re-verified "adjustable but not removable"; v2.1.297 and v2.1.298 were never published; Anthropic's pre-announced spend controls delivered nothing for a third pass — in-window it shipped OpenTelemetry export, i.e. visibility, the exact axis this doctrine distinguishes; no new citable cost-overrun incident; no peer shipped a dollar ceiling; no in-window paper proposes a new agent self-verification method (the field is moving toward external gates, which supports this repo's stance); and --restricted is still absent from sandbox-environments (5th pass) — ⚠️ a careless grep nearly manufactured a resolution there, because the ordinary word "restricts" appears in the prose.
• Gartner tripwire fired with an honest empty: the Symposium opened Oct 19, the day this window closed, so nothing on agent cost had landed; the one in-window release is off-angle (provider capex impairment). Expect material next window, including an inaugural Hype Cycle for Agentic AI (Oct 20).

Verification method

• Claude Code changelog: fetched as changelog.md (1.1 MB, with explicit <Update label="…" description="October 18, 2026"> date attributes) rather than the 4.8 MB rendered page — cheaper and immune to the year trap. In-window range sliced and grepped locally; the whole file was also grepped per hard-stop token, which is how v2.1.217 surfaced. Version dates cross-checked against the npm time map.
• All 22 arXiv IDs machine-verified in two batched id_list calls (both HTTP 200): 22/22 resolved, zero unresolved, zero hallucinated, 15 with v1 in-window, each checked for ID ↔ exact title ↔ v1 published ↔ primary category ↔ author count. Two agent-reported corrections were confirmed: 2610.09159 is cs.AI, and 2610.13065 is titled TestSuiteBench. ⚠️ Last pass's second-call 429 did not reproduce.
• Read from source at a pinned ref, not from a release page: LiteLLM's budget limiter at main/v1.106.0/v1.105.1/v1.107.0-rc.1; agentgateway's comparison at HEAD; Codex's accounting.rs at tag rust-v0.163.0; Gas City's config and dispatch at HEAD.
• Package dates from PyPI/npm JSON only. No release is dated from a summarizer's rendering of an undated page.
• ⚠️ I corrected my own near-miss: an initial grep suggested --restricted had appeared in sandbox-environments (resolving a five-pass item); checking the context showed it was the ordinary word "restricts". The item stays open.
• ⚠️ Research agents correctly reported tooling blocks rather than routing around them — GitHub API access is scoped to espi/loops, and no agent called add_repo on a third-party repo. ✅ New: git ls-remote --tags plus a filtered single-tag clone works through the proxy, which dated six third-party projects and retires the standing request for read access to openai/codex, block/goose and sst/opencode.

Pruning and the size budget

The primer went 748 → 750 lines, exactly its budget, so kb-size should pass at 750/750. Holding it there while absorbing this much required moving older per-item prose verbatim into a new archive/primer-detail-2026-10.md (§5A items 3–6 and 9–11, item 8's carrier detail, item 12's full vacuity dossier, and §3's fuller per-voice prose) and condensing §3, §4's peer matrix, §5B and §6's per-vendor paragraphs. Every claim removed from the primer is still carried, with its source and confidence, in sources.md. Per step 6, superseded text was replaced, not left beside the correction.

Nine backlog items archived (Google Spend Caps' GA question + its companion quote item; Gemini's maxSessionTurns ambiguity; opencode's tag dates; "three peers not date-trackable"; the three unread backfill papers; Osmani's two uncited statistics; the AAIF membership question; plugin eval's budget masquerade), six more resolved in place because each left a narrower successor question.

⚠️ Every currently-open re-verify item (95 → 127)

Per step 2, the full standing backlog, not only what is new. It lives in sources.md under "Known caveats / things to re-verify". * marks the 35 opened this pass.

Security (19) — *the harness's ceilings are defeatable from the extension surface; *a guard skippable by prototype-key stripping + plan mode writing through an allowed hook; *frontmatter allowed-tools removes prompts but does not restrict reach (59% under-declare); *a low ASR is not evidence of a defence; *adopt the vacuity/self-attestation vocabulary and its three follow-on guardrail calls; the in-loop check needs a provenance clause; a metered verifier's ceiling is a kill-switch; scanning source is not admission control / popularity is not provenance; discount ASRs that presuppose selection; adopt onFailure: "block"; per-edit gates don't compose; a command-prefix allowlist is not a sandbox; GitSpawn ultrareview (7th pass, unconfirmed); does the PR-review gate bind what the reviewer sees to what merges?; is every write path to a protected region covered by self-edit-guard?; vendor artifact for 2609.01222; does X-CPE reach this repo's knowledge/?; adopt PROCTOR canaries / hash-pinning / provisional-persistent split / annealed edit budget?; --restricted is not an OS sandbox (5th pass).

Guardrails (41) — *🔴 main has no branch protection (measured); *🔴 hard stop #3's enforcement has failed open twice; *interrupt/resume is a cross-vendor leak; *🔴 a truthiness-gated guard is not a guard (3 instances); *Gemini's one-value-two-meanings zero; *the meter is wrong four ways across two vendors; *the Spend Limits API reads 0 for unknown; *record which stop fired; *a stall detector's false-positive side; *wall-clock as an unnamed fourth stop; *three findings on this routine's own substrate (duplicate re-run, Completed for dead runs, -p permission-mode change); *set RETRY_WATCHDOG_MAX_USAGE_LIMIT_WAIT_MS (undocumented); *the dist-tags.stable lag; *budget ceilings should scale with code health; the claude/ prefix is a default not enforcement; the Routine caps are hourly and wait; three ways a routine can appear to run and do nothing; hard stop #1's fourth leak + /goal's resume reset; the meter erred both ways; set RETRY_WATCHDOG_MAX_WAIT_MS; an aborted call is still billed; /loop ships none of the three stops; Haiku 5.5's cliff on the /goal evaluator (wants a measurement); the AWS cell's opt-in correction; the exhausted-budget header vs status code; Managed Agents' three boundaries; task budgets unsupported on Claude Code + too-small-budget refusals; AgentGuard's Claude Code hook + the 90-day price-table gate; an available stall policy is not an engaged one; classify failures to short-circuit the cap; a deterministic ceiling on a replay substrate; a ceiling can leak through its meter; four status codes for an exhausted budget; a per-run budget is not a campaign ceiling (this routine's shape); AWS's limited availability + destructive tail; OpenRouter's zero-budget semantics; fixed caps vs progress-authorized continuation + context growth; verify an injected guardrail reached the model; zero-valued ceilings (LiteLLM still shipping it in v1.106.0); the LiteLLM fail-open family; Anthropic's undelivered spend controls (3rd pass); adopt OpenRouter's cost endpoint.

Tooling (24) — *``plugin eval's residual gap, narrowed and now documented as deliberate; *MCP allow rules narrowed silently; *Factory's 10-runs/hour cap unlocated; *Amp is a content block; *the Haiku tripwire must be re-pointed at the Bedrock/Vertex tables; *``experimental-ext-server-card dormant while SEP-2127 merged; *use gastownhall/gascity; *Gas City's unreleased workladder; *Agent Router's serviceQuota still unenforced; *AG2 v1.2.0 tagged-but-unpublished (8 days); *add tracking for agentgateway and A2A; *Qodo is 3.1 + roborev v0.72.0 + Kodus not reached + CodeRabbit's cap needs first-party confirmation; the peer-harness matrix correction; the Codex row overstated; the MCP standards corrections + satellite repos; the Agent Skills governance asymmetry; the first-party plugin evaluator reads the maker's trace; the MCP metadata budget growth; URL and naming hygiene; two unreleased things to confirm; opencode's v2.0.x line (dates now resolved); the 1 GB tool-results cap (5th pass, changelog-only); the /loop//goal version-minimum human call; SKILL.md cross-tool execution.

Research / infrastructure (43) — *three fetch techniques that remove coverage holes (full-text feeds, the .md changelog, the npm tarball); *the byline trap moved into the datetime attribute; *grep the author's own archive before calling a statistic uncited; *two host migrations + two path corrections; *arXiv API behaviour + the raw-host directory-listing limit; *blacklist additions + dev.to/mech_app_ai as a distortion source pattern; *dated tripwires (Gartner Oct 19–22 now live; Hype Cycle for Agentic AI Oct 20; Sonnet 4.5 retires Nov 30; GPT-5.6 promo to Nov 21; LiteLLM v1.107.0 / #44259); *the Ronacher wording rule; the YYMM trap in both directions; shallow-clone date fabrication + GitHub topic-page strings; the ghuntley byline skew; stop citing an aggregate skill count; skill utility is configuration-dependent (an artifact-audit trigger); the Mandiant distortion watch; annotate the two $6,000 figures; blacklist additions + the per-claim nuance; the unpromoted Cherny lead; two research-path techniques; Jev corroborated as a classifier; Osmani's .com blog lags Substack (now ~30 days, and it has no working feed); magnitudes don't cross papers; Steinberger's permanent coverage gap; the x.com note correction + snowflake decoding; Osmani's Sep 7 X post (still unread on his surface); Cherny's structural limit; Huntley's recap dating; the YC-hackathon field report; the "Jev may be two things" question; the do-not-cite SkillsBench figures; the marketing-dominated query space; the four recycled dollar anecdotes; the Jun 15 billing split; Microsoft dropping Claude Code; the /goal origin timeline; the "costliest thing" slogan; roborev's 403s (raw-mirror workaround confirmed); the arXiv 406/301 modes; openai.com PDF primaries; the GitHub access shape (now improved by git ls-remote).

Worth a closer look

• Suggestion 1 is the one I would act on first. It is no longer an argument from doc silence — your main is measurably unprotected, and the same single action also turns self-edit-guard from a visible red X into a real gate. This repo currently asserts two enforced gates it does not have, which is precisely the error it exists to warn about.
• The vacuity taxonomy is the most useful thing in this diff. The repo had independently discovered instances of it for weeks without a name; now it has the name, a six-instance inventory, and an instrument — and the three follow-on guardrail changes (fail-closed checks, in-attempt ceilings, a vacuity probe in loop-guardrails) are small and concrete.
• Suggestion 8 (the backlog's growth) is a scope decision only you can make. I can keep carrying 127 items forward indefinitely, but the ratio is getting worse each pass and much of the growth is self-correction rather than news.
• CI: kb-size should pass at 750/750; self-edit-guard has no self-edit: commit to inspect.
• Nothing in guardrails/, budget.env, CLAUDE.md, .claude/settings*, runbooks/, templates/ or the gate was touched — this PR is knowledge/ only.

---

Generated by Claude Code